From 6bbbf3e8d3bddacf8cf6c9dfa28799cc21b81064 Mon Sep 17 00:00:00 2001 From: Jordan Harband Date: Sun, 18 Oct 2026 23:18:31 -0700 Subject: [PATCH] [Tests] `nvm_download`: point the httpbin Authorization check at a configured mirror The httpbin check sends `$NVM_AUTH_HEADER` to `http://127.0.0.1/bearer` without configuring a mirror. Set `$NVM_NODEJS_ORG_MIRROR` to that host, as a real user of the header would, so the check keeps exercising the header once it is only sent to URLs under a mirror Discovered by Anthropic's OSS Scanner, as ANT-2026-YPW87EDH; the scanner reported it as a vulnerability, but it is not one. --- test/fast/Unit tests/nvm_download | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/fast/Unit tests/nvm_download b/test/fast/Unit tests/nvm_download index ced54895..92d7447e 100755 --- a/test/fast/Unit tests/nvm_download +++ b/test/fast/Unit tests/nvm_download @@ -29,7 +29,7 @@ done if [ "${httpbin_pulled}" = 1 ] && SHELL=bash docker run -d --name httpbin -p 80:80 kennethreitz/httpbin; then sleep 1 # wait for httpbin to start # nvm_download should pass when calling with auth header - NVM_AUTH_HEADER="Bearer test-token" nvm_download "http://127.0.0.1/bearer" > /dev/null || die 'nvm_download with auth header should send correctly' + NVM_NODEJS_ORG_MIRROR="http://127.0.0.1" NVM_AUTH_HEADER="Bearer test-token" nvm_download "http://127.0.0.1/bearer" > /dev/null || die 'nvm_download with auth header should send correctly' # nvm_download should fail when calling without auth header nvm_download "http://127.0.0.1/bearer" > /dev/null && die 'nvm_download with no auth header should not send the header and should fail' else